PHP security releases in 2026: which ones affect WordPress
PHP shipped security releases in May, July, September and October 2026. Most of the vulnerabilities live in extensions a WordPress site never touches; one pair — PHP2Shell, fixed on 21 October — affects almost every PHP site and is being exploited. Here is each release, what it fixed, and whether it matters for WordPress and WooCommerce.
Which PHP versions are still supported
| Branch | Status (30 October 2026) | Latest release |
|---|---|---|
| 8.5 | Active support | 8.5.12 |
| 8.4 | Active support until 31 Dec 2026, then security fixes | 8.4.27 |
| 8.3 | Security fixes only | 8.3.36 |
| 8.2 | Security fixes only — end of life 31 December 2026 | 8.2.35 |
| 8.1 and older | End of life: no releases | — |
A site on PHP 8.1 or older is receiving no security fixes from the PHP project at all. Sites on 8.2 have two months left; plan the move to 8.3 or newer now, while it is a choice rather than an emergency.
21 October: PHP2Shell — affects WordPress, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619: unauthenticated remote code execution, triggered while PHP parses an incoming request, before any WordPress code runs. Confirmed on Apache mod_php, considered likely on FPM and LiteSpeed. CISA lists both as actively exploited. This is the one to act on — see what to do about PHP2Shell.
Two follow-ups the same week: on 23 October PHP published an advisory for CVE-2026-115560, which only applies to code that switches the session serializer at runtime with upload progress enabled — setting session.upload_progress.enabled = 0 covers it, and the fix comes in the next regular release. On 26 October, Windows builds were reissued (8.x.y-1) with Brotli 1.2.1 for CVE-2026-111497, reachable only when an application turns on cURL’s automatic response decompression — Windows servers only.
24 September: 8.5.11, 8.4.26, 8.3.35, 8.2.34
| CVE | What it is | Does it matter for WordPress? |
|---|---|---|
| CVE-2026-91765 | Denial of service in SoapServer | Only if the site runs a SOAP server endpoint — rare |
| CVE-2026-91766 | HTTP stream wrapper sends Authorization and Cookie headers on to another site after a redirect | Low: WordPress’s HTTP API normally uses cURL, not stream wrappers; matters for code calling file_get_contents() on URLs with credentials |
| CVE-2026-91768 | PHP-FPM listen.allowed_clients ignored for IPv6 | Only if you rely on that setting to restrict who can reach FPM |
The release also fixed issues in Phar, mysqlnd, filters and OpenSSL certificate-name handling. None of these is known to be exploited, but they are reason enough to stay on the current release rather than skipping a cycle.
2 and 30 July
| CVE | What it is | Does it matter for WordPress? |
|---|---|---|
| CVE-2026-17543 | SQL injection in pg_insert(), pg_update() and related PostgreSQL helpers | No — WordPress uses MySQL or MariaDB |
| CVE-2026-17544 | Out-of-bounds write in BCMath bccomp() | Rarely: only code using BCMath on untrusted input |
| CVE-2026-14355 | Memory corruption in OpenSSL AES-WRAP-PAD | Only code that uses that specific cipher mode |
7 May: 8.5.6, 8.4.21, 8.3.31, 8.2.31
A batch of fixes across mbstring, SOAP, the standard library, the FPM status page and PDO_Firebird. Mostly relevant to sites using those extensions directly; the FPM status-page fix matters only if that page is reachable from the internet, which it should not be.
What to do
- Check the PHP version serving your site: Tools → Site Health → Info → Server.
- Make sure it is at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12 — or a distribution package that includes the October fixes.
- On PHP 8.1 or older, or 8.2, plan the upgrade to 8.3, 8.4 or 8.5.
- Restart PHP after every update so the running workers use the fixed code.
- Keep plugins and themes current too: most real-world WordPress compromises still come through extensions, not PHP itself.